Admin CSRF invalid

Identifiers

Field	Value
Type URI	https://echo.labstack.com/pro/problems/admin-csrf-invalid
Code	admin_csrf_invalid
HTTP status	403

HTTP status	English title
403	Forbidden

When it occurs

A POST authenticated by a cookie or another credential that the browser sends automatically did not carry a valid CSRF token. The token was missing, malformed or expired, or it belongs to another session.

Client handling

Reload the page to get a fresh form and token, then submit again. API clients can send an explicit header credential, which needs no CSRF token.

Example response

If your application installs a custom handler, the body may differ.

HTTP/1.1 403 Forbidden
Content-Type: application/problem+json
Cache-Control: no-store

{
  "code": "admin_csrf_invalid",
  "detail": "",
  "status": 403,
  "title": "Forbidden",
  "type": "https://echo.labstack.com/pro/problems/admin-csrf-invalid"
}

Server correction

Check Principal.Session and retained Config.Keys across instances. Cookie-authenticated POSTs need the token issued for the same session.

Response fields

Admin console

• code (string, always): The stable code above.
• detail (string, always): The console always sends detail. It is often empty and never contains the underlying error.
• status (integer, always): The HTTP status of the response.
• title (string, always): The HTTP status text, such as Conflict, unless the panel supplies its own title.
• type (string, always): The exact type URI above.

Headers:

• Cache-Control (always): no-store. The console sends it on every problem response, along with its usual security headers.

Notes:

• Fields are written in alphabetical order.
• The console rewrites every 404 response to admin_not_found with an empty detail.

Related behavior

See the admin console for access checks, action IDs and audit failures.